I've been studying all the ways Taproot transactions can be spent and I can get all of them to work except for when script path spending is used and the script is executed. Transaction 0c045625... is a good example. I'll focus on input 0 here.

I have successfully recreated the merkle tree of tagged hashes to match the witness program from the previous output, which I thought would be the hard part but it turned out to be quite easy.

But when the script finally executes, it still has to succeed, which means in most cases the signatures will also have to be verified. I can successfully verify signatures in key path spending inputs, but none of the script path spending ones.

Here is the segwit data for input 0 (the first two fields are the signatures):


Here is the parsed witness script for input 0:


Using Schnorr signatures, I can not get these public keys to verify the signatures. The signatures use sighash byte 01, or the default 00.

As for the data to be signed, I've tried verifying these signatures using TapSighash tagged hashes of the data (like I do for key path spending), or just using a single or double SHA256 of the data, but nothing works.

As for the public key to verify the signatures, I've tried using the public keys in the script directly, or applied as tweaks to an xonly public key parsed from the witness program, and vice versa, but nothing I've used to tweak any of these 32-byte pubkeys works either.

Since the public keys are 32 bytes and the signatures are 64 (and it's a Taproot transaction), I assume these must be verifiable using Schnorr signatures.

What am I missing? All the other stuff I've done with Schnorr signatures works, and it is pretty simple. So there has to be a step I am missing.

For input 0 in the transaction linked to above, here is the data that my program is using to attempt to verify these signatures:

Witness Program:


Public Keys:




Hash of Data to Sign (using only a single SHA256 of the serialized pieces of data, which seems to be the Taproot convention):


When a script path is used to redeem a Taproot output, and the script is executed, how are these pieces of data used to verify the signatures when OP_CHECKSIG is called?

  • 2
    Did you construct the hash being signed according to the rules in BIP342? The rules are slightly different for script path spending and key path spending. Aug 30, 2022 at 18:45
  • 1
    That was it. The extension described in BIP342 was missing. After I added that, it worked.
    – Zephyrus
    Aug 31, 2022 at 16:35
  • @Zephyrus Could you make your solution into an answer and mark it as accepted, so that the question doesn't show as being unanswered? Oct 20 at 23:09


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.